Security update for 389-ds SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3996-1 Final 1 1 2022-11-15T16:07:01Z current 2022-11-15T16:07:01Z 2022-11-15T16:07:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for 389-ds This update for 389-ds fixes the following issues: - CVE-2021-45710: Fixed tokio data race with memory corruption (bsc#1194119). - Update to version 2.0.16~git56.d15a0a7: - Failure to migrate from openldap if pwdPolicyChecker present (bsc#1205146). - Resolve issue with checklist post migration when dds is present (bsc#1204748). - Improve reliability of migrations from openldap when dynamic directory services is configured (bsc#1204493). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/389-ds:latest-2022-3996,SUSE-2022-3996,SUSE-SLE-Module-Server-Applications-15-SP4-2022-3996,openSUSE-SLE-15.4-2022-3996 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223996-1/ Link for SUSE-SU-2022:3996-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012931.html E-Mail link for SUSE-SU-2022:3996-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1194119 SUSE Bug 1194119 https://bugzilla.suse.com/1204493 SUSE Bug 1204493 https://bugzilla.suse.com/1204748 SUSE Bug 1204748 https://bugzilla.suse.com/1205146 SUSE Bug 1205146 https://www.suse.com/security/cve/CVE-2021-45710/ SUSE CVE CVE-2021-45710 page Container suse/389-ds:latest SUSE Linux Enterprise Module for Server Applications 15 SP4 openSUSE Leap 15.4 389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 lib389-2.0.16~git56.d15a0a7-150400.3.15.1 libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 389-ds-devel-2.0.16~git56.d15a0a7-150400.3.15.1 389-ds-snmp-2.0.16~git56.d15a0a7-150400.3.15.1 389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of Container suse/389-ds:latest lib389-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of Container suse/389-ds:latest libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of Container suse/389-ds:latest 389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-devel-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 lib389-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of openSUSE Leap 15.4 389-ds-devel-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of openSUSE Leap 15.4 389-ds-snmp-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of openSUSE Leap 15.4 lib389-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of openSUSE Leap 15.4 libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 as a component of openSUSE Leap 15.4 An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption. CVE-2021-45710 Container suse/389-ds:latest:389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 Container suse/389-ds:latest:lib389-2.0.16~git56.d15a0a7-150400.3.15.1 Container suse/389-ds:latest:libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:389-ds-devel-2.0.16~git56.d15a0a7-150400.3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:lib389-2.0.16~git56.d15a0a7-150400.3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 openSUSE Leap 15.4:389-ds-2.0.16~git56.d15a0a7-150400.3.15.1 openSUSE Leap 15.4:389-ds-devel-2.0.16~git56.d15a0a7-150400.3.15.1 openSUSE Leap 15.4:389-ds-snmp-2.0.16~git56.d15a0a7-150400.3.15.1 openSUSE Leap 15.4:lib389-2.0.16~git56.d15a0a7-150400.3.15.1 openSUSE Leap 15.4:libsvrcore0-2.0.16~git56.d15a0a7-150400.3.15.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223996-1/ https://www.suse.com/security/cve/CVE-2021-45710.html CVE-2021-45710 https://bugzilla.suse.com/1194119 SUSE Bug 1194119